Cold Email Deliverability: The Setup Checklist

Start with permission and relevance

Cold email deliverability is the ability to get legitimate business messages accepted and placed where recipients can see them. Delivery and inbox placement are different: a receiving server can accept a message and still send it to spam. Authentication helps establish who sent it, but it cannot compensate for unwanted outreach or an unlawful contact strategy.

Before configuring anything, define the audience precisely. Write down the company profile, relevant role, business problem and observable reason for contacting each account. For example, a Geneva software provider might target finance leaders at Swiss companies expanding into multiple entities, rather than every finance address it can find. Use business signals, not assumptions about an individual.

Then establish whether the planned outreach is legally permissible. A named work address is not automatically permission to send a campaign. If the contact basis, relevance or recipient identity is unclear, resolve that uncertainty before adding the record to a sending platform.

Apply the Swiss legal frame before launch

The Swiss Unfair Competition Act (UWG/LCD) regulates unsolicited mass advertising sent by telecommunications. It generally requires prior consent, correct sender identification and an easy, free refusal mechanism. A limited existing customer exception can apply to a company's own similar offerings when the statutory conditions are met. There is no blanket B2B exemption, and personalising a template does not automatically take a campaign outside these rules.

The revised Federal Act on Data Protection (revDSG/nLPD) also matters when business contact records identify individuals. Address transparency, proportionality, purpose, accuracy, security, retention and applicable rights. Record where contact data came from, provide appropriate privacy information and assess providers, contractual safeguards and international transfers. A public LinkedIn profile is not, by itself, marketing consent.

Where EU contacts are involved, assess GDPR applicability as well as relevant national electronic marketing rules. A legitimate interests assessment under GDPR does not override separate consent requirements. Have Swiss counsel review the planned workflow, including any customer exception. Specific cases need legal advice before launch.

Choose a transparent sending architecture

List every system that sends email on your behalf: employee mailboxes, CRM, invoicing software, support tools and outreach platform. Decide which system will send prospecting messages and who owns its administration. Uncontrolled overlap makes authentication failures harder to diagnose and increases the risk of contacting the same person from several accounts.

Consider a clearly branded subdomain when separating outreach operationally from transactional mail. It may make monitoring and policy management easier, but it is not a firewall: reputation signals can cross related domains and infrastructure. If using a separate domain, make its relationship to the business obvious. Avoid lookalike spellings, disposable domains and domain rotation intended to evade filtering.

Use a real sender identity with a monitored inbox. Configure replies to reach someone who can answer questions and process refusals. Choose a provider whose acceptable use policy permits your actual workflow, then enable multifactor authentication and restrict administrator access. A compromised mailbox can damage an otherwise careful setup.

Configure SPF DKIM and DMARC correctly

SPF identifies authorised sending infrastructure for the envelope sender domain. Publish one SPF record per domain and include only services that genuinely send for it. Check the SPF DNS lookup limit before adding another provider. Multiple SPF records or unnecessary nested includes can cause evaluation errors even when the record looks plausible.

DKIM adds a cryptographic signature to outgoing messages. Enable it in each sending service, publish the required DNS records and verify the signature on an actual received message. DMARC checks whether a passing SPF or DKIM identity aligns with the visible From domain. Authentication passing somewhere in the headers is not enough if alignment fails.

Start DMARC monitoring with an appropriate reporting address and review reports to identify legitimate senders. Move towards quarantine or rejection once those senders are correctly configured. Do not enforce rejection blindly: invoices or support replies could be affected. For managed mailboxes, ask the provider about infrastructure controls such as reverse DNS and TLS rather than assuming they are settings you manage yourself.

Verify contacts and maintain suppression records

A verified address is a technical confidence signal, not proof of consent or relevance. For every contact, retain the company, role, source, collection date, preferred business language where known and documented contact basis. Recheck records before use if they have been sitting in a CRM or if the person's role may have changed.

Treat verification results differently. Remove invalid addresses before sending. Review uncertain and catch all results instead of classifying them as safe by default. Catch all domains may accept mail for nonexistent users, so an SMTP check cannot establish that a specific mailbox exists. Avoid guessing address patterns across an entire management team.

Maintain a central suppression record covering objections, unsubscribes, hard bounces and other exclusions. Apply it across every mailbox and campaign before each send. Keep only the information needed to honour suppression, with controlled access and an appropriate retention policy. Someone who opts out must not reappear because another list supplier later provides the same address.

Test carefully and increase volume cautiously

Before contacting prospects, send test messages through the exact production workflow to accounts you control at several mailbox providers. Inspect authentication results, formatting, sender identity, reply handling and unsubscribe behaviour. Test the actual signature and any links. Seed inboxes can expose technical problems, but their placement does not predict placement for every prospect.

Avoid artificial engagement networks that manufacture opens or replies. They do not establish genuine recipient demand and may conflict with provider policies. A new mailbox needs a stable, legitimate usage pattern, not a sudden automated burst. Provider sending limits are ceilings, not recommended campaign volumes.

Launch only a small, legally reviewed cohort that a person can supervise. There is no universal safe daily volume: domain history, recipient mix, infrastructure and feedback all matter. Increase activity only when authentication remains correct, delivery errors are understood and recipient responses support continuing. Pause expansion after an unexplained rise in rejections, complaints or unwanted contact feedback, rather than switching domains and carrying on.

Write messages that justify the interruption

Keep the first message focused on one relevant observation and one answerable question. Use plain formatting, an accurate subject and a short signature identifying the business. Avoid attachments, shortened links and unnecessary tracking in the first contact. These are risk reduction choices, not magic rules: plain text cannot rescue irrelevant or noncompliant outreach.

For a recipient who has explicitly requested follow up, the message could read: Subject: Your Swiss account targeting question. Hello Claire, you asked at our Geneva roundtable for details on reaching finance teams in French and German. We help define target accounts and run outreach in both languages. Would a short conversation next week help you assess whether this fits your sales process? Kind regards, Philip, Lead Generation Switzerland. If you would prefer no further email, reply and I will update our records.

Use that context only when it is true. For a permitted follow up, try: Is this still something you are evaluating, or should I close the conversation? Match English, French or German to the recipient's working language, not merely their city.

Control sequences and make refusal easy

Set sequence rules before activating automation. Stop on a reply until a person has reviewed it, and suppress immediately when the recipient objects. Handle out of office messages separately so that an automated response does not trigger an inappropriate sales reply. Deduplicate at both person and company level where several colleagues could receive overlapping approaches.

Write each permitted follow up to add something useful, such as a clarification of scope or an answer to a likely implementation question. Repeated reminders with no new substance create pressure without improving relevance. If there is no credible reason for another message, end the sequence. Do not treat silence as evidence that more channels are welcome.

Make refusal simple and free. Monitor reply based opt outs, provide an accessible unsubscribe method and implement the technical unsubscribe headers required by the providers and message types you use. Switching to LinkedIn or phone does not erase an objection. Carry suppression decisions into the wider outbound programme and assess the rules for each channel.

Measure outcomes and diagnose failures

Track attempted sends, server acceptances, hard bounces, temporary failures, complaints where available, unsubscribes, human replies, positive replies, qualified meetings booked and meetings held. Define each measure and its denominator. For example, positive replies divided by accepted messages is useful only if the team consistently distinguishes genuine interest from automated responses and polite refusals.

Do not use open rates as proof of interest. Privacy features, image proxies and security systems can inflate opens, while blocked images can hide them. Link scanners can also inflate clicks. Human replies and held meetings provide better evidence of commercial relevance, although neither replaces a check on compliance or inbox placement.

Review results weekly by mailbox, recipient provider, segment and language. A cluster of authentication failures points to configuration. Invalid recipient errors suggest list problems. Provider specific deferrals may indicate throttling or reputation issues. Read SMTP responses before deciding what to change. Pause the affected stream, correct the likely cause and test again; repeated retries or higher volume usually make diagnosis harder.

Book a strategy call to review your setup

A useful launch decision brings three checks together: a legally reviewed contact approach, a technically sound sending setup and a target audience with a credible reason to listen. Assign an owner to each. Keep a short launch record showing authentication test results, list provenance, suppression checks, approved messages and the reporting definitions your team will use.

Lead Generation Switzerland is a founder led Swiss B2B outbound agency based in Geneva, founded by Philip Allsopp. It operates across Geneva, Lausanne, Zurich, Basel, Zug and Bern in English, French and German. Its work covers ICP definition, verified Swiss target lists, email, LinkedIn and phone outreach, qualified meetings booked into the client's calendar and weekly reporting.

To discuss your cold email deliverability setup, book a strategy call with Lead Generation Switzerland. Bring your sending domains, current tools, target segments and recent delivery errors if available. The conversation can clarify what needs fixing, what should wait and whether Starter, Growth or Premium fits the scope. No package can guarantee inbox placement or replace advice on your specific legal position.

Questions and answers

Does passing SPF DKIM and DMARC guarantee inbox placement?

No. Authentication helps receivers verify the sender and detect impersonation, but placement also depends on reputation, recipient feedback, message characteristics and provider policies. Check alignment on real messages, then monitor delivery errors and human responses. A correctly authenticated campaign can still reach spam if recipients do not want it.

Can I send cold emails to any Swiss business address?

No blanket permission exists for B2B email. The Swiss Unfair Competition Act governs unsolicited mass advertising, and the revised Federal Act on Data Protection can apply to identifiable business contacts. Public availability is not consent. Assess the campaign, any applicable exception and transparency requirements with legal counsel before sending.

How many cold emails should a new mailbox send each day?

There is no universally safe number. Start with a small, permissible audience after testing authentication and reply handling. Let provider policies, delivery feedback and recipient reactions guide any increase. Do not mistake a platform's maximum sending allowance for a safe operating target, or use extra mailboxes to bypass restrictions.

Should I track email opens to identify interested prospects?

Open tracking cannot reliably identify interest. Mail privacy systems, image proxies and security tools can record opens without a person reading the message. Some genuine reads are not recorded at all. Prioritise relevant human replies, qualified meetings and meetings held, while using delivery diagnostics to investigate technical problems.